Extracted

• • Target

    stub.exe

  • Size

    45KB

  • MD5

    7b6df057cf7e923a43da88e8058b740f

  • SHA1

    9a106e83e0e9a5f2df9f7fffd626a12230700e49

  • SHA256

    9f1f2c2d9f93d52c9b8bb0df11dd186327a9f428a8bf74943a9923ac6c62fb1f

  • SHA512

    b2a213a39143b8cfed5bc4db93dd16b4537d56110e093459f6f1e2521aa110399e16456e6fe835e8f4c690d2d39d9b020f022cb0fabf7be58daae81a10718480

  • SSDEEP

    768:vdhO/poiiUcjlJInQTwH9Xqk5nWEZ5SbTDaSWI7CPW5p:lw+jjgnBH9XqcnW85SbTLWIR

  Score

  10^/10

  xenoratrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2behavioral3behavioral4